SC-900 Practice Test 33 — 15 Questions

Question 1

An organization uses Microsoft Intune to manage devices. The security team wants to ensure that only devices with a minimum OS version and antivirus enabled can access corporate email. What should they configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Conditional Access policy referencing device compliance. A Conditional Access policy referencing device compliance is correct because it allows the security team to enforce access controls based on real-time device health signals, such as minimum OS version and antivirus status. When a device is marked as non-compliant by Intune, the Conditional Access policy blocks access to corporate email (e.g., Exchange Online) until the device meets the required compliance criteria. This combines Intune's compliance evaluation with Microsoft Entra ID's access enforcement, ensuring only healthy devices can access corporate resources.

Answer

Device enrollment restrictions

Answer

App protection policies in Microsoft Defender for Cloud Apps

Answer

A device compliance policy

Question 2

A company runs a production Kubernetes cluster in Azure. The security team needs to continuously monitor the cluster for misconfigurations, such as containers running with privileged access or secrets exposed in environment variables. They also want to detect runtime threats like crypto-mining containers. Which Microsoft security solution should they use?

Accepted Answer

Microsoft Defender for Cloud. Microsoft Defender for Cloud provides Cloud Security Posture Management (CSPM) and Cloud Workload Protection Platform (CWPP) capabilities. It continuously assesses Kubernetes clusters against the CIS Kubernetes Benchmark, detecting misconfigurations like privileged containers and exposed secrets in environment variables, and uses behavioral analytics to detect runtime threats such as crypto-mining containers.

Answer

Microsoft Sentinel

Answer

Microsoft Defender for Endpoint

Answer

Microsoft Defender for Cloud Apps

Question 3

A company uses Microsoft Purview. A compliance officer applies a retention label to a set of legal documents and configures the label to mark the items as records. After the label is applied, a user attempts to delete one of these documents from SharePoint Online. What will be the outcome?

Accepted Answer

The user receives an access denied error and cannot delete the document.. When a retention label is configured to mark items as records, the items become immutable and locked. In SharePoint Online, records cannot be deleted by users; any attempt to delete a record results in an 'access denied' error because the retention policy overrides standard user permissions to enforce compliance.

Answer

The user is allowed to delete the document, but a copy is retained in a preservation hold.

Answer

The document is deleted and immediately purged from the recycle bin.

Answer

The delete action is allowed but an audit event is generated and the document is still retained for the specified period.

Question 4

A security operations team needs to protect Windows servers from ransomware and other advanced threats. They require a solution that provides endpoint detection and response (EDR), automated investigation, and the ability to isolate compromised machines from the network. Which Microsoft security solution should they deploy?

Accepted Answer

Microsoft Defender for Endpoint. Microsoft Defender for Endpoint (MDE) is the correct solution because it provides endpoint detection and response (EDR), automated investigation and remediation, and network isolation capabilities specifically for Windows servers and endpoints. These features directly address the requirement to protect against ransomware and advanced threats by detecting suspicious behavior, automatically investigating alerts, and allowing admins to isolate compromised machines from the network to prevent lateral movement.

Answer

Microsoft Defender for Cloud

Answer

Microsoft Defender for Identity

Answer

Microsoft Defender for Office 365

Question 5

A company uses Microsoft Entra ID. The security team wants to grant temporary, time-bound administrative access to the Microsoft 365 user management role for IT support staff. The access should require an approval from a senior administrator, and all actions should be audited. Which Microsoft Entra ID feature should they configure?

Accepted Answer

Privileged Identity Management (PIM). Privileged Identity Management (PIM) in Microsoft Entra ID provides just-in-time (JIT) privileged access with time-bound role activation, approval workflows, and full auditing. This directly matches the requirement for temporary, approved administrative access to the Microsoft 365 user management role with audit trails.

Answer

Conditional Access

Answer

Identity Protection

Answer

Identity Governance

Question 6

A security architect is explaining the evolution of the security perimeter. They state that because users access corporate resources from anywhere on any device, the traditional network perimeter is no longer sufficient. What does the architect identify as the new primary security perimeter?

Accepted Answer

The identity. In modern zero-trust architectures, identity is the new primary security perimeter because it enables granular access control regardless of network location. Since users access corporate resources from anywhere on any device, authentication and authorization (via protocols like OAuth 2.0, SAML, and OpenID Connect) become the decisive factor for granting access, rather than the traditional network boundary. This shift is foundational to Microsoft's identity-centric security model, where Microsoft Entra ID (now Microsoft Entra ID) acts as the control plane for all resource access.

Answer

The cloud infrastructure

Answer

The data center

Answer

The endpoint

Question 7

A company has several on-premises web-based applications that need to be securely accessed by remote employees without requiring a VPN. The IT team wants to provide single sign-on (SSO) using Microsoft Entra ID. Which Microsoft Entra ID feature should they implement?

Accepted Answer

Microsoft Entra Application Proxy. Microsoft Entra Application Proxy enables secure remote access to on-premises web applications without a VPN by acting as a reverse proxy. It integrates with Microsoft Entra ID to provide single sign-on (SSO) for users, leveraging pre-authentication and conditional access policies. This directly meets the requirement for VPN-less, SSO-enabled access.

Answer

Microsoft Entra Self-Service Password Reset (SSPR)

Answer

Microsoft Entra Privileged Identity Management (PIM)

Answer

Microsoft Entra Identity Protection

Question 8

A security team needs to investigate a potential data breach that may involve unauthorized access to sensitive files in SharePoint Online and OneDrive for Business. They want to search the unified audit log for file access events, including accesses from mobile devices and third-party applications. Additionally, they need to create custom alert policies that trigger when specific high-privilege users download large volumes of files in a short period. Which Microsoft Purview solution should they use?

Accepted Answer

Microsoft Purview Audit (Premium). Microsoft Purview Audit (Premium) is the correct solution because it provides the deep, granular logging required to investigate data breaches, including file access events from mobile devices and third-party applications in SharePoint Online and OneDrive for Business. It also supports the creation of custom alert policies that can trigger on specific activities, such as high-privilege users downloading large volumes of files in a short period, by leveraging the unified audit log's rich schema and advanced detection capabilities.

Answer

Microsoft Purview eDiscovery (Premium)

Answer

Microsoft Purview Data Lifecycle Management

Answer

Microsoft Purview Communication Compliance

Question 9

A company uses Microsoft 365. The compliance team needs to create a policy that automatically blocks outgoing emails that contain personally identifiable information (PII) such as social security numbers. However, they want to allow users to override the block with a business justification if necessary. Which Microsoft Purview solution should they configure?

Accepted Answer

Data Loss Prevention (DLP). Data Loss Prevention (DLP) in Microsoft Purview is designed to detect and protect sensitive information, such as social security numbers, by automatically blocking outgoing emails that contain PII. DLP policies support user override with a business justification through policy tips and allow overrides, enabling compliance teams to balance security with business needs.

Answer

Communication Compliance

Answer

Records Management

Answer

Audit

Question 10

A company uses Microsoft Entra ID. The IT team wants to provide remote employees with secure, single sign-on (SSO) access to a critical on-premises web application that uses password-based authentication, without requiring a VPN connection. Which Microsoft Entra ID feature should they use?

Accepted Answer

Microsoft Entra Application Proxy. Microsoft Entra Application Proxy enables secure remote access to on-premises web applications by publishing them through an external endpoint, without requiring a VPN. It supports password-based SSO by securely storing and replaying credentials to the legacy application, allowing users to authenticate once via Entra ID. This makes it the correct choice for providing SSO to a password-based on-premises app without a VPN.

Answer

Microsoft Entra Connect

Answer

Microsoft Entra Domain Services

Answer

Microsoft Entra ID P2 license

Question 11

Which TWO of the following are features of Microsoft Purview Data Loss Prevention (DLP)? (Select TWO.)

Accepted Answer

Provide policy tips to users. Correct answers: D and E. D: Provide policy tips to users is a feature of Microsoft Purview DLP that educates users about policy violations. E: Monitor and prevent sharing of sensitive data is the primary function of DLP. Option A: Detect and block malware is a feature of Microsoft Defender for Endpoint. Option B: Apply sensitivity labels is a feature of Microsoft Information Protection. Option C: Manage user access rights is a feature of Entra ID (Identity Governance).

Answer

Detect and block malware

Answer

Apply sensitivity labels

Answer

Manage user access rights

Question 12

A company wants to provide secure external access to a partner application without creating user accounts manually. They need to allow partners to authenticate using their existing corporate identities (e.g., from other organizations) and configure policies for access. Which Microsoft Entra feature should they use?

Accepted Answer

Microsoft Entra External ID (B2B collaboration). Microsoft Entra External ID (B2B collaboration) allows organizations to securely share applications and resources with external partners by letting them authenticate using their own corporate identities (e.g., from other Microsoft Entra ID tenants, Microsoft accounts, or social identity providers). It eliminates the need to manually create and manage user accounts for partners, while enabling you to apply conditional access policies for granular control over external access.

Answer

Microsoft Entra Identity Protection

Answer

Microsoft Entra Privileged Identity Management

Answer

Microsoft Entra Domain Services

Question 13

Refer to the exhibit. An administrator creates a DLP rule as shown. What is the expected outcome when a user tries to share a file containing a U.S. Social Security Number with an external recipient?

Accepted Answer

The sharing is blocked, and the user receives a notification.. The DLP rule is configured with an action of 'Block' (or 'BlockAccess') and user notification enabled. When a user attempts to share a file containing a U.S. SSN with an external recipient, the rule blocks the sharing and displays a notification to the user explaining that the action is blocked. Option A is incorrect because the rule applies to all users, not just non-owners. Option B is incorrect because the rule does more than generate an audit event; it actively blocks the sharing. Option C is incorrect because the rule blocks the action outright, rather than allowing it with justification.

Answer

The sharing is blocked only if the user is not the file owner.

Answer

The sharing is allowed, but an audit event is generated.

Answer

The file is shared, but the user is notified and must provide justification.

Question 14

A company requires all employees to provide a one-time passcode generated by an authenticator app in addition to their password when accessing the corporate VPN. This practice is an example of which security concept?

Accepted Answer

C. Authentication. The requirement for a one-time passcode (OTP) from an authenticator app in addition to a password is a classic implementation of multi-factor authentication (MFA). Authentication is the process of verifying the identity of a user, device, or service, and this scenario uses two distinct factors: something you know (password) and something you have (the OTP generated by the app). This directly aligns with the security concept of authentication, not authorization, auditing, or accounting.

Answer

A. Authorization

Answer

B. Auditing

Answer

D. Accounting

Question 15

A large enterprise is concerned about insider threats. The compliance team needs to detect and investigate potential data theft scenarios, such as when employees nearing their resignation date suddenly copy large amounts of sensitive data to USB drives or email confidential files to personal accounts. They require a solution that uses machine learning to identify risky activities and create alerts for investigation. Which Microsoft Purview solution should they deploy?

Accepted Answer

Insider Risk Management. Insider Risk Management is the correct solution because it uses machine learning to correlate signals from user activities (e.g., copying files to USB, emailing to personal accounts) with contextual indicators like resignation dates, enabling detection of potential data theft scenarios. It provides built-in alerting and investigation workflows specifically designed for insider threat use cases, unlike the other options which focus on retention, auditing, or compliance posture.

Answer

Data Lifecycle Management

Answer

Audit (Premium)

Answer

Compliance Manager